topic Re: Log content for ingest rule contains more than one line in Log Analytics

Log content for ingest rule contains more than one line

a_chiaravalle — Fri, 24 May 2024 14:20:54 GMT

Hi Team

From java application server's log (Linux) I want to capture only the rows related to START and END events of some batch.

To do this, I defined a "Log Ingest rule":

but when I check the result of this rule In the log viewer, I see that "log content" contains other lines other than the START events (bolded).

This is the entire log content with multiple lines:

I expect to have only one line and I don't have an explanation for this behavior considering that at the end of each line there is a carriage return (\n) character.

Could you please verify what is wrong ?

Thanks and Regards

Antonello Chiaravalle

Re: Log content for ingest rule contains more than one line

Mizső — Fri, 24 May 2024 15:51:57 GMT

Hi @a_chiaravalle,

Ingest rules is not a filter. With this rule you ingested the entire log file which conatins your START value from the choosen processes.

I order to drop the unnecessary lines you should set a log drop rule (carefully) to this log ingest rule.

In the log drop rule matcher you should put your log.source and a nagate content filter. In the log viewer you can check the result. You should see only the unwanted loglines in the result. This expession should be in the log drop rule.

Example:

I hope it helps.

Best regards,

Mizső